The flaw causes JsonTemplateLayout to produce JSON that contains NaN, Infinity, or –Infinity values, which are forbidden by the JSON standard. When such logs are emitted, downstream log ingestion or indexing systems may reject the record or crash, effectively corrupting audit data. An attacker can trigger this only by sending an attacker‑controlled MapMessage containing one of those prohibited values, so the vulnerability does not enable code execution but can cause a loss of critical logs or a service interruption.

Apache Software Foundation’s Log4j JSON Template Layout, with all releases through and including 2.25.3, are affected. The fix is available in 2.25.4.

The CVSS score of 6.3 indicates a medium‑severity risk. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, suggesting a low exploitation probability. However, if the attacker can inject MapMessages into the application, they could exhaust log processing resources or trigger failures that result in denial of service or loss of audit information. The attack vector is likely remote, originating from any application component that accepts user input and logs it via JsonTemplateLayout.